DLA Piper Intelligence brings together knowledge sites that answer legal questions from our clients around the globe. The main laws that apply to the handling of data about individuals are the Personal Information Protection Act (“PIPA”) (amended in September 2023) and the Act on the Use and Protection of Credit Information (“CIA”). Prior to 5 August 2020, the Act on Promotion of Information and Communications Network Utilization and Data Protection (“Network Act”) contained data protection-related provisions applicable to Online Service Providers (OSPs), which are (i) telecommunications service providers registered under the Telecommunications Business Act or (ii) a person who provides information or mediates the provision of information for profit by using services provided by a telecommunications service provider. Most organisations that operate websites / apps (except for non-profit organisations) as well as network operators are OSPs. However, most of these provisions were moved to the PIPA (Chapter 6, Special Rules on Processing of Personal Information by Online Service Providers), pursuant to an amendment to the Network Act and the PIPA that went into effect on 5 August 2020. In 2023, the PIPA was further amended in keeping up with the principle of “same conduct – same regulation” for all personal data controllers by repealing special provisions that previously only applied to OSPs.  The Amended PIPA has become effective from 15 September 2023, with certain exceptions such as the right of portability, where the effective date is yet to be determined. On 23 November 2023, the Personal Information Protection Commission (“PIPC”) which is tasked with enforcing the PIPA proposed an amendment to the Enforcement Decree of the PIPA to provide the subordinate details of the PIPA amendments. The main laws that apply to the handling of data about individuals are the Personal Information Protection Act (“PIPA”) (amended in September 2023) and the Act on the Use and Protection of Credit Information (“CIA”). Prior to 5 August 2020, the Act on Promotion of Information and Communications Network Utilization and Data Protection (“Network Act”) contained data protection-related provisions applicable to Online Service Providers (OSPs), which are (i) telecommunications service providers registered under the Telecommunications Business Act or (ii) a person who provides information or mediates the provision of information for profit by using services provided by a telecommunications service provider. Most organisations that operate websites / apps (except for non-profit organisations) as well as network operators are OSPs. However, most of these provisions were moved to the PIPA (Chapter 6, Special Rules on Processing of Personal Information by Online Service Providers), pursuant to an amendment to the Network Act and the PIPA that went into effect on 5 August 2020. Information that identifies a particular individual by his / her full name, resident registration number, image, etc. Information under items (a) or (b) above that is pseudonymised in accordance with the relevant provisions and thereby becomes incapable of identifying a particular individual without the use or combination of information for restoration to the original state (referred to as “pseudonymised information”). membership, political views or membership in a political party, health or medical treatment information, sexual orientation, genetic  information, criminal records and biometric data for the purpose of uniquely identifying a natural person and race / ethnic information. Sensitive information can be processed if (a) such processing is required or permitted by a statute, or (b) the consent of the data subject is separately obtained. The PIPC is in charge of the enforcement of PIPA. Matters specified as the work of the PIPC by the PIPA or other statutes. Under PIPA, there is no general rule regarding the registration of personal data controller, however, a public institution which manages a personal information file (i.e. collection of personal information) shall register the following with the PIPC. A “public institution” in this context refers to any government agency or institution. the scope of personal information inspection of which can be restricted or rejected and the grounds therefore only “public institutions” are required to register with the PIPC. Under PIPA, every personal data controller (which means any person, any government entity, company, individual or other person that, directly or through a third party, controls and / or processes personal information in order to operate personal information files as part of its activities) must designate a chief privacy officer (“CPO”) who must be an employee or executive of the company. destroying personal information for which the purpose of processing has been achieved or for which the retention period has expired. The Proposed Enforcement Decree of the PIPA lays the grounds for the CPO to independently perform his / her duties. Under the Proposed Enforcement Decree, a personal data controller must (i) guarantee the CPO’s access to all information in relation to the processing of personal information, (ii) establish a system for the CPO’s direct reporting to the representative and the board of directors at least once a year, (iii) provide the CPO with human and material resources by creating an organizational structure suitable for the performance of duties, and (iv) prohibit a situation where the CPO is placed at a disadvantage by reason of non-compliance with unreasonable instructions. Personal data controllers that meet certain criteria are required to designate a CPO with (i) at least three years of experience in personal information protection, and (ii) a combined career of at least six years in personal information protection, data protection, and information technology. More specifically, the obligation to designate a CPO with the foregoing qualifications is applicable to an entity whose annual sales revenue or income amounts to at least KRW 150 billion, and (i) processes sensitive information or unique identification information of at least 50,000 data subjects, or processes personal information of at least 1 million data subjects; (ii) is a school under the Higher Education Act with at least 10,000 enrolled students as of December 31 of the immediately preceding year; (iii) is a tertiary hospital under the Medical Service Act; or (iv) is a public institution operating a personal information processing system which meets the standards set by the PIPC. Under the PIPA, there must be a specific legitimate basis for collection and use of personal information, with the most representative basis being the data subject's consent. As a result, in principle, the explicit consent of data subjects must be obtained before processing their personal information. However, the data subjects' consent is not required in cases where the processing of personal information is prescribed by a statute or where it is necessary for an entity to process personal information in order to comply with its legal obligations. where it is necessary to attain the legitimate interests of a personal data controller, the interest of which is manifestly superior to the rights of the data subject. In such cases, processing shall be allowed only to the extent the processing is substantially related to the legitimate interests of the personal information controller and does not go beyond a reasonable scope. While one consent form may be used, separate consents must be obtained respectively for each type of processing activity (e.g. collection and use, third party provision) and for different types of personal information (e.g. unique identification information and sensitive information). the fact that the data subject has a right to refuse to give consent and the negative consequences or disadvantages that may result due to any such refusal. The processing of the RRN (which is a type of unique identification information) is prohibited even with the consent of the data subject unless the processing is explicitly required or permitted under a statute. As a general rule, a personal data controller may not provide personal information to a third party without obtaining the prior opt in consent of the data subject. where it is urgently necessary for the public safety and security, public health, etc. the fact that the data subject is entitled to deny consent, and disadvantages, if any, resulting from the denial of consent. means and process by which the data subjects may refuse to consent to the transfer of personal information. where the countries or international organizations that personal information is transferred to are recognized by the PIPC as having an adequate level of protection. While this exemption from the overseas consent requirement was only applicable to OSPs, the amended PIPA now applies this exemption to all personal data controllers. method and procedure for rejecting the cross-border transfer and the consequences thereof. measures for preventing intrusion of computer viruses, including installation and operation of vaccine software, and other protective measures necessary for securing the safety of personal information. The competent authorities may request reports on the handling of personal information, and also may issue recommendations or orders if a personal data controller violates the PIPA. Non-compliance with a request or violation of an order can result in fines, imprisonment, or both. For example, PIPC, the supervising authority, can issue a corrective order in response to any breach of an obligation not to provide personal information to a third party. Breach of a corrective order leads to an administrative fine of not more than KRW 30 million. Prior to issuing a corrective order, PIPC may take an incremental approach and instruct, advise and make  recommendations to the personal data controller. On the other hand, where personal information has been transferred to a third party without the consent of the data subject and in the absence of exceptional circumstances, both the transferor and the transferee (if it received the personal information knowing that the data subject had not given consent) can be subject to criminal sanctions (imprisonment of up to 5 years or a criminal fine of up to KRW 50 million). Under the Network Act, anyone who intends to transmit an advertisement by electronic transmission media must receive the explicit consent of the individual, but if the individual either withdraws consent or does not give consent, then an advertisement for profit may not be transmitted. instructions on how to consent or withdraw consent for receipt of the advertisement information. a measure to register electronic mail addresses automatically with intent to transmit advertising information for profit, and various measures to hide the identity of the sender of advertising information or the source of transmission of an advertisement. Cookie, logs, IP information, etc. may also be regulated by the PIPA as personal information, if combined with other information may enable the identification of a specific individual person easily. The protection of location information is governed by the provisions of the Act on the Protection, Use, etc. of Location Information (“LBS Act”). there is a request by the police for the rescue of the person whose life or physical safety is in immediate danger, or there exist special provisions in any Act. Under the LBS Act, any person (entity) who intends to provide services based on location information (“Location-based Service Provider”) shall report to the Korea Communications Commission (“KCC”). Further, any person (entity) who intends to collect location information and provide the collected location information to Location-based Service Providers (“Location Information  Provider”) shall obtain a license from the KCC. matters concerning notifying the personal location information subject of the provision of location information to a third party as below. © 2024 DLA Piper. DLA Piper is a global law firm operating through various separate and distinct legal entities. For further information about these entities and DLA Piper's structure, please refer to our Legal Notices. All rights reserved. Attorney Advertising.